Briefing — 3 November 2026

Security News

Artificial Intelligence and Cyber Intrusion (NCSC)
Major new NCSC threat assessment projecting AI-enabled attacks on UK critical infrastructure within two years. The report identifies longstanding security weaknesses tolerated under the assumption they were too costly to exploit at scale — AI eliminates that assumption. Urgent call for resilience investment.

Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years (NCSC)
NCSC Director General accompanies the report with a public warning that "tech on the cheap" has left UK organisations exposed as AI makes vulnerability discovery and exploitation at scale newly practical.

Chinese hackers use ARTEX AI in automated attacks against 200+ organisations (BleepingComputer)
China-linked threat actors are using the ARTEX agentic offensive framework — documented by Google just days ago — in active, automated attacks spanning 14 countries. The weaponisation timescale from research to operational use: under one week.

Hackers disrupt refrigeration systems at European supermarkets (second wave) (BleepingComputer)
A second wave of OT cyberattacks on commercial refrigeration systems hit grocery chains across Belgium, Ireland, Luxembourg, and Sweden — temperatures raised to 50°C in some units, causing mass food spoilage. The first wave struck weeks ago; two attacks in quick succession suggests an active campaign or traded access.

Max-severity Node-RED RCE actively exploited to deliver Linux malware in ICS environments (The Register)
A critical vulnerability in Node-RED, the flow-based OT programming tool used across factories and utilities, is being actively exploited to deploy a Linux bot. Widely deployed in critical infrastructure.

Ivanti patches two more zero-days chained in Connect Secure attacks (SecurityWeek)
CVE-2026-111357 and CVE-2026-118527 added to the CISA KEV catalogue; both have been exploited in chained attacks since at least October 1. Patch immediately.

Ukraine and Russia both confirm emergency alert system compromises — false nuclear warnings broadcast (The Record)
Officials from both countries have now confirmed Sunday's attacks. Ukrainian hackers breached a Russian air raid alert system in retaliation for a prior Russian intrusion into Ukraine's equivalent. False nuclear missile strike warnings were broadcast to the public. First confirmed bilateral exchange of this nature.

LLMJacking: Token thieves costing companies $100K+ per day in illicit LLM charges (Google/Mandiant)
Mandiant documents attackers hijacking corporate LLM access keys to resell AI compute. Victim organisations facing API bills exceeding $100,000 per day. Rotate your LLM API keys and audit usage anomalies.

Florida Student Aid breach — 4.9 million people at risk (SecurityWeek)
Florida Department of Education confirms SSNs and personal data exposed via a hack of its financial aid website.

Mercado Bitcoin confirms cyberattack — $46M in outflows (The Record)
Brazil's largest cryptocurrency exchange confirms an attack with more than $46 million drained from the platform.

Google dismantles XCPE botnet — 1.3M Android TV boxes intentionally infected by manufacturer (BleepingComputer)
Google and partners disrupted the XCPE backdoor botnet. Google attributes the malware to Videostrong Technology, which deliberately infected its own devices to monetise ad fraud and proxy crime.

Apple warns users in 99 countries of mercenary spyware (The Record)
New round of Apple threat notifications sent to individuals in 99 countries. Apple cites the "extreme cost, sophistication, and worldwide nature" of mercenary spyware as justification for not attributing specific actors.

CISA Known Exploited Vulnerabilities

Two new additions — both Ivanti Connect Secure zero-days:

CVE-2026-111357 — Ivanti Connect Secure — RCE, chained in active attacks since October 1
CVE-2026-118527 — Ivanti Connect Secure — RCE, chained in same attack sequence
CISA KEV Catalogue →

NCSC

Artificial Intelligence and Cyber Intrusion — New NCSC report published 3 November 2026. Assessment of AI-enabled threat trends and projections to 2028. Mandatory reading for UK security teams.

Ransomware Activity — 23 victims, 14 groups (48 hours)

N0n — 5 victims

Five unidentified US companies (Companies #113–#117). Data publication threatened within 2–3 days.

Akira — 3 victims ⚠️

Howells Motor Freight (United States) — Trucking & Freight Transportation ⚠️ Critical Logistics
Princeton Management (Financial Services); USNext (unclassified)

Qilin — 2 victims ⚠️

Isapre Consalud (Chile) — Health Insurance Provider ⚠️ Healthcare
Astino Berhad (Malaysia) — Manufacturing

Further groups

Redact: Holland & Knight (United States) — Major US law firm; attorney-client privilege exposure risk
direwolf: My Cloud Grocer 🇬🇧 (United Kingdom) — Retail
HYFLOCK: Ateşsan Ambalaj (Turkey, Manufacturing); Hitech Group (US, Technology)
everstake: 2 redacted technology targets
safepay: deom.be (Belgium)
pear: Neiman & Company (US, Financial Services)
Orova: Harry's International (Singapore, Retail)
SilentRansomGroup: 1 unnamed victim
Whitearmor: AmplifAI (US, Technology)
Shiba: Tema Hwt (Germany)
lockbit5: synergy.co.id (Indonesia)

Threat Feed Highlights

AI-powered attacks on 200+ organisations — China-linked actor used ARTEX-class AI automation against organisations across 14 countries, targeting education, technology, and government sectors.

Iran-aligned DarkBlinders — Claims to have compromised a high-profile Israeli individual and an Iraqi Kurdish government cloud environment.

Rakuten Market breach claim — Threat actor claims 103 million records associated with the Japanese e-commerce platform.

Spanish government data sale claim — Threat actor claiming to sell a database associated with the Government of Spain. Unverified.